SUPERAntiSpyware Trojen.Agent/Gen-Kryptic

[poison]

Hi, today after booting into windows I had a warning from SAS that it had found a threat so I did a full scan with the following result:

http://i.imgur.com/z6AbA.jpg

To be honest I think something is wrong with SAS after the definition update and the threats are probably a false positive as I haven't download anything new etc. I tried to go over to the SAS website but it takes me to http://www.superantispyware.com/siteunavailable.html so I cannot check if others have the same problem. Just wondered if anybody here has had the same threat today maybe after the latest definition update?

[JohnBurns]

Similar thing happening to me this morning. I checked the system just before shutdown last night with SAS and no detections. But, this morning suddenly, I am infected? Hope they get it sorted out soon.

[poison]

Thanks for the reply.. I had a feeling it would be a screw up from SAS as NOD32 didn't report anything and MBAM and HitmanPro both came back clean:

http://i.imgur.com/DRJ1c.jpg

http://i.imgur.com/tNqcU.jpg

I didn't clean or quarantine anything with SAS and the odd alert is still popping up on random safe files as seen here:

http://i.imgur.com/LLavd.jpg

[sbcc]

I'm seeing it too. Clean files tagged as generic Kryptic trojan files.

Calls are coming in from my clients. I have a very busy day, suddenly. I have an unconfirmed report of an unbootable computer, and another that lost internet access.

In the case of the one I'm working on now, it flagged a .dll that's part of the Broadcom wireless driver and also the registry filter entries for the accelerometer on a Dell studio laptop.

More reports are showing up on the SAS false positive section of their forum.

Not good.

[poison]

Not good at all. Some of the files that it reported as infected could have caused some real problems for me too, I'm sure. I'm just pleased that I have been the only person on the computer for the last day or so and had a hunch that it was a possibly false positive.

I finally got to the forums and see the database has been updated to 9127 now. I haven't had any more alerts but I'm going to reboot in a moment to see what happens.

Hopefully that's the end of it now and I hope you don't have too many more clients with problems.

[JohnBurns]

I believe they have now corrected this with a new update......

[poison]

Originally Posted by JohnBurns

I believe they have now corrected this with a new update......

Yeah everything seems OK now on 9127

[sbcc]

Originally Posted by poison

Not good at all. Some of the files that it reported as infected could have caused some real problems for me too, I'm sure. I'm just pleased that I have been the only person on the computer for the last day or so and had a hunch that it was a possibly false positive.

I finally got to the forums and see the database has been updated to 9127 now. I haven't had any more alerts but I'm going to reboot in a moment to see what happens.

Hopefully that's the end of it now and I hope you don't have too many more clients with problems.

Thanks! Appreciate the good wishes and the update info. I won't be looking at the damaged computers until late in the day today. So far, no more calls. Let's hope that trend holds.

ETA: Just got done repairing the damage to one of the computers. 200+ files quarantined as Trojan.Agent/Gen-Kryptic, including all system restore points. Restoring from quarantine fixed almost everything, but not the wireless utility. It had to be downloaded and reinstalled.

Glad you got to it before someone else decided to quarantine everything.